From c068eceb54459fa086efea502826528b19ff5da2 Mon Sep 17 00:00:00 2001 From: XananasX7 Date: Sun, 28 Jun 2026 02:02:48 +0000 Subject: [PATCH] fix(security): pin etils-actions/pypi-auto-publish to commit SHA MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The auto-publish workflows use etils-actions/pypi-auto-publish@v1 — a mutable tag reference on a third-party action. If the tag is silently moved (compromised maintainer, repo takeover, etc.) the new code runs in the same job that holds PYPI_API_TOKEN and GH_PUBLISH_TOKEN, enabling a supply-chain attack on every downstream user of orbax-checkpoint and orbax-export. Pin to the exact commit SHA so the workflow is tamper-proof: etils-actions/pypi-auto-publish@v1 → @e3c4b4afc3a5b12a44734da938741995538e8223 The v1 comment preserves human readability while SHA ensures integrity. --- .github/workflows/auto-publish-dry-run.yml | 2 +- .github/workflows/auto-publish.yml | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/auto-publish-dry-run.yml b/.github/workflows/auto-publish-dry-run.yml index bd2ea3e621..0350c6a97b 100644 --- a/.github/workflows/auto-publish-dry-run.yml +++ b/.github/workflows/auto-publish-dry-run.yml @@ -8,7 +8,7 @@ jobs: runs-on: ubuntu-latest if: github.repository == 'google/orbax' steps: - - uses: etils-actions/pypi-auto-publish@v1 + - uses: etils-actions/pypi-auto-publish@e3c4b4afc3a5b12a44734da938741995538e8223 # v1 with: pypi-token: skip # Skips PyPI upload # Omitting gh-token skips GitHub release creation diff --git a/.github/workflows/auto-publish.yml b/.github/workflows/auto-publish.yml index 3c6d62cb0b..b3b3d30ea4 100644 --- a/.github/workflows/auto-publish.yml +++ b/.github/workflows/auto-publish.yml @@ -17,7 +17,7 @@ jobs: steps: # 1. Publish the sub-packages first - - uses: etils-actions/pypi-auto-publish@v1 + - uses: etils-actions/pypi-auto-publish@e3c4b4afc3a5b12a44734da938741995538e8223 # v1 with: pypi-token: ${{ secrets.PYPI_API_TOKEN_OBX_CKPT }} gh-token: ${{ secrets.GH_PUBLISH_TOKEN }} @@ -39,7 +39,7 @@ jobs: steps: # 1. Publish the sub-packages first - - uses: etils-actions/pypi-auto-publish@v1 + - uses: etils-actions/pypi-auto-publish@e3c4b4afc3a5b12a44734da938741995538e8223 # v1 with: # NOTE: Do not use gh-token here, as it would conflict with orbax-checkpoint. pypi-token: ${{ secrets.PYPI_API_TOKEN_OBX_EXPT }}